Automation and Assurance · Topic 7 of 7

SNMP v2c and v3

Configure and verify SNMP versions 2c and 3, including community strings, traps and informs, SNMPv3 users, groups and views, and the three security levels.

5 min

In a nutshell

Polling uses UDP port 161, and traps and informs use UDP port 162.
A trap is unacknowledged, and an inform is acknowledged.
SNMPv2c sends the community string in clear text.

What it is

SNMP lets a management station read data from devices and receive alerts from them.

A device runs an agent that keeps its data in a database called a MIB. The management station polls the agent, and the agent can also send unrequested alerts.

Version 2c is simple but sends a password in clear text. Version 3 adds real authentication and encryption.

How it works

SNMP has a fixed set of operations, and each version protects them in a different way.

Components

Component	Role
Manager	The network management station that asks questions
Agent	The software on the device that answers
MIB	The tree of managed objects on the device
OID	The number that names one object in the tree

Each object has an object identifier (OID), a dotted number that gives its place in the MIB tree. Polling uses UDP port 161 on the agent. Traps and informs go to UDP port 162 on the manager.

Operations

Operation	Purpose
Get	Read one object
GetNext	Read the next object in the tree
GetBulk	Read many objects in one request (v2c and v3)
Set	Change an object
Trap	An unacknowledged alert from the agent
Inform	An alert that the manager must acknowledge (v2c and v3)

An inform is more reliable than a trap, because the agent resends it if there is no reply. A trap is lighter, and the agent never knows whether it arrived.

SNMPv2c

Version 2c uses a community string as a shared password. A read only string allows Get, and a read write string allows Set. The string is sent in clear text, so anyone who can capture the traffic can read it.

Limit access with an access list, use strings that are hard to guess, and prefer read only.

Router(config)# ip access-list standard SNMP_MGR
Router(config-std-nacl)# permit 192.0.2.50
Router(config)# snmp-server community S3cretRO RO SNMP_MGR
Router(config)# snmp-server host 192.0.2.50 version 2c S3cretRO
Router(config)# snmp-server enable traps

SNMPv3

Version 3 uses users, not community strings. It has three security levels:

Level	Authentication	Encryption
noAuthNoPriv	Username only	None
authNoPriv	Yes, with a hash	None
authPriv	Yes, with a hash	Yes

Authentication proves who sent the message and that it was not changed, using a hash such as SHA. Privacy encrypts the content, using an algorithm such as AES.

The configuration has three parts. A view limits which part of the MIB is visible.

A group links a security level to a view. A user belongs to a group and holds the keys.

Router(config)# snmp-server view VIEW1 iso included
Router(config)# snmp-server group ADMINS v3 priv read VIEW1
Router(config)# snmp-server user USER1 ADMINS v3 auth sha AUTHPASS priv aes 128 PRIVPASS
Router(config)# snmp-server host 192.0.2.50 version 3 priv USER1
Router(config)# snmp-server enable traps

The priv keyword in the group line sets the minimum level for that group to authPriv. The host line sets the level that traps use.

The IOS XR form is similar, and the main differences are the trap destination and the way user passwords are entered.

RP/0/RP0/CPU0:R1(config)# snmp-server view VIEW1 iso included
RP/0/RP0/CPU0:R1(config)# snmp-server group ADMINS v3 priv read VIEW1
RP/0/RP0/CPU0:R1(config)# snmp-server host 192.0.2.50 traps version 3 priv USER1

The snmp-server user line is left out here, because its password options differ on IOS XR, so check the syntax for the release.

Verifying

Router# show snmp user
Router# show snmp group
Router# show snmp host
RP/0/RP0/CPU0:R1# show snmp host

The first three commands are IOS XE and the last is IOS XR. The show snmp user command on IOS XE lists each v3 user with its group and levels. The command show snmp host lists the trap destinations and the version used for each.

Comparing the versions

Item	v2c	v3
Identity	Community string	User name
Authentication	Community in clear text	Hash based, per user
Encryption	None	Optional, with authPriv
Access control	Community and ACL	Views, groups and users
Inform and GetBulk	Yes	Yes

What to remember for the exam

Seven facts cover most questions on this topic.

Polling uses UDP port 161, and traps and informs use UDP port 162.
A trap is unacknowledged, and an inform is acknowledged.
SNMPv2c sends the community string in clear text.
SNMPv3 uses users, groups and views.
The three v3 levels are noAuthNoPriv, authNoPriv and authPriv.
authPriv gives both authentication and encryption.
snmp-server host sets where traps go, and the version and level they use.

Exam tip

For a secure design, choose SNMPv3 with authPriv. A question that mentions encryption of the SNMP payload points to it.

Common mistakes

These four mistakes appear often.

Using a read write community when read only is enough. Anyone who learns the string can change the device.

Giving a user less security than its group requires. If the group needs authPriv and the user has only authentication, the requests fail.

Forgetting snmp-server enable traps. No traps are sent, even though a host is set.

Mixing up traps and informs. Only informs are acknowledged.

Watch out

Do not use the default or a common word as a community string. It can be guessed and the device read at once.

Check yourself

Work through these three questions.

How does an inform differ from a trap?
An inform is acknowledged by the manager and resent if there is no reply, while a trap is not acknowledged.
Which SNMPv3 level gives both authentication and encryption?
authPriv.
Why is SNMPv2c weak?
It sends the community string in clear text, so anyone who captures the traffic can read it.

Topic 7 of 7 in Automation and Assurance

Test yourself on Automation and Assurance

The full Cisco CCNP 350-501 SPCOR question bank has 738 questions, with timed practice exams and an explanation for every answer.

Subscribe Try Sample Exam

This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.